# Redmine - project management software
        
      
        

          
          
          # Copyright (C) 2006-2012  Jean-Philippe Lang
        
      
        

          
          
          #
        
      
        

          
          
          # This program is free software; you can redistribute it and/or
        
      
        

          
          
          # modify it under the terms of the GNU General Public License
        
      
        

          
          
          # as published by the Free Software Foundation; either version 2
        
      
        

          
          
          # of the License, or (at your option) any later version.
        
      
        

          
          
          #
        
      
        

          
          
          # This program is distributed in the hope that it will be useful,
        
      
        

          
          
          # but WITHOUT ANY WARRANTY; without even the implied warranty of
        
      
        

          
          
          # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
        
      
        

          
          
          # GNU General Public License for more details.
        
      
        

          
          
          #
        
      
        

          
          
          # You should have received a copy of the GNU General Public License
        
      
        

          
          
          # along with this program; if not, write to the Free Software
        
      
        

          
          
          # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
        
      
        

          
          
          
        
      
        

          1
          
          class AccountController < ApplicationController
        
      
        

          1
          
            helper :custom_fields
        
      
        

          1
          
            include CustomFieldsHelper
        
      
        

          
          
          
        
      
        

          
          
            # prevents login action to be filtered by check_if_login_required application scope filter
        
      
        

          1
          
            skip_before_filter :check_if_login_required
        
      
        

          
          
          
        
      
        

          
          
            # Login request and validation
        
      
        

          1
          
            def login
        
      
        

          242
          
              if request.get?
        
      
        

          121
          
                logout_user
        
      
        

          
          
              else
        
      
        

          121
          
                authenticate_user
        
      
        

          
          
              end
        
      
        

          
          
            rescue AuthSourceException => e
        
      
        

          
          
              logger.error "An error occured when authenticating #{params[:username]}: #{e.message}"
        
      
        

          
          
              render_error :message => e.message
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Log out current user and redirect to welcome page
        
      
        

          1
          
            def logout
        
      
        

          4
          
              logout_user
        
      
        

          4
          
              redirect_to home_url
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Lets user choose a new password
        
      
        

          1
          
            def lost_password
        
      
        

          
          
              redirect_to(home_url) && return unless Setting.lost_password?
        
      
        

          
          
              if params[:token]
        
      
        

          
          
                @token = Token.find_by_action_and_value("recovery", params[:token].to_s)
        
      
        

          
          
                if @token.nil? || @token.expired?
        
      
        

          
          
                  redirect_to home_url
        
      
        

          
          
                  return
        
      
        

          
          
                end
        
      
        

          
          
                @user = @token.user
        
      
        

          
          
                unless @user && @user.active?
        
      
        

          
          
                  redirect_to home_url
        
      
        

          
          
                  return
        
      
        

          
          
                end
        
      
        

          
          
                if request.post?
        
      
        

          
          
                  @user.password, @user.password_confirmation = params[:new_password], params[:new_password_confirmation]
        
      
        

          
          
                  if @user.save
        
      
        

          
          
                    @token.destroy
        
      
        

          
          
                    flash[:notice] = l(:notice_account_password_updated)
        
      
        

          
          
                    redirect_to signin_path
        
      
        

          
          
                    return
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
                render :template => "account/password_recovery"
        
      
        

          
          
                return
        
      
        

          
          
              else
        
      
        

          
          
                if request.post?
        
      
        

          
          
                  user = User.find_by_mail(params[:mail].to_s)
        
      
        

          
          
                  # user not found or not active
        
      
        

          
          
                  unless user && user.active?
        
      
        

          
          
                    flash.now[:error] = l(:notice_account_unknown_email)
        
      
        

          
          
                    return
        
      
        

          
          
                  end
        
      
        

          
          
                  # user cannot change its password
        
      
        

          
          
                  unless user.change_password_allowed?
        
      
        

          
          
                    flash.now[:error] = l(:notice_can_t_change_password)
        
      
        

          
          
                    return
        
      
        

          
          
                  end
        
      
        

          
          
                  # create a new token for password recovery
        
      
        

          
          
                  token = Token.new(:user => user, :action => "recovery")
        
      
        

          
          
                  if token.save
        
      
        

          
          
                    Mailer.lost_password(token).deliver
        
      
        

          
          
                    flash[:notice] = l(:notice_account_lost_email_sent)
        
      
        

          
          
                    redirect_to signin_path
        
      
        

          
          
                    return
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # User self-registration
        
      
        

          1
          
            def register
        
      
        

          
          
              redirect_to(home_url) && return unless Setting.self_registration? || session[:auth_source_registration]
        
      
        

          
          
              if request.get?
        
      
        

          
          
                session[:auth_source_registration] = nil
        
      
        

          
          
                @user = User.new(:language => Setting.default_language)
        
      
        

          
          
              else
        
      
        

          
          
                user_params = params[:user] || {}
        
      
        

          
          
                @user = User.new
        
      
        

          
          
                @user.safe_attributes = user_params
        
      
        

          
          
                @user.admin = false
        
      
        

          
          
                @user.register
        
      
        

          
          
                if session[:auth_source_registration]
        
      
        

          
          
                  @user.activate
        
      
        

          
          
                  @user.login = session[:auth_source_registration][:login]
        
      
        

          
          
                  @user.auth_source_id = session[:auth_source_registration][:auth_source_id]
        
      
        

          
          
                  if @user.save
        
      
        

          
          
                    session[:auth_source_registration] = nil
        
      
        

          
          
                    self.logged_user = @user
        
      
        

          
          
                    flash[:notice] = l(:notice_account_activated)
        
      
        

          
          
                    redirect_to :controller => 'my', :action => 'account'
        
      
        

          
          
                  end
        
      
        

          
          
                else
        
      
        

          
          
                  @user.login = params[:user][:login]
        
      
        

          
          
                  unless user_params[:identity_url].present? && user_params[:password].blank? && user_params[:password_confirmation].blank?
        
      
        

          
          
                    @user.password, @user.password_confirmation = user_params[:password], user_params[:password_confirmation]
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          
          
                  case Setting.self_registration
        
      
        

          
          
                  when '1'
        
      
        

          
          
                    register_by_email_activation(@user)
        
      
        

          
          
                  when '3'
        
      
        

          
          
                    register_automatically(@user)
        
      
        

          
          
                  else
        
      
        

          
          
                    register_manually_by_administrator(@user)
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Token based account activation
        
      
        

          1
          
            def activate
        
      
        

          
          
              redirect_to(home_url) && return unless Setting.self_registration? && params[:token]
        
      
        

          
          
              token = Token.find_by_action_and_value('register', params[:token])
        
      
        

          
          
              redirect_to(home_url) && return unless token and !token.expired?
        
      
        

          
          
              user = token.user
        
      
        

          
          
              redirect_to(home_url) && return unless user.registered?
        
      
        

          
          
              user.activate
        
      
        

          
          
              if user.save
        
      
        

          
          
                token.destroy
        
      
        

          
          
                flash[:notice] = l(:notice_account_activated)
        
      
        

          
          
              end
        
      
        

          
          
              redirect_to signin_path
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            private
        
      
        

          
          
          
        
      
        

          1
          
            def authenticate_user
        
      
        

          121
          
              if Setting.openid? && using_open_id?
        
      
        

          
          
                open_id_authenticate(params[:openid_url])
        
      
        

          
          
              else
        
      
        

          121
          
                password_authentication
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def password_authentication
        
      
        

          121
          
              user = User.try_to_login(params[:username], params[:password])
        
      
        

          
          
          
        
      
        

          121
          
              if user.nil?
        
      
        

          
          
                invalid_credentials
        
      
        

          121
          
              elsif user.new_record?
        
      
        

          
          
                onthefly_creation_failed(user, {:login => user.login, :auth_source_id => user.auth_source_id })
        
      
        

          
          
              else
        
      
        

          
          
                # Valid user
        
      
        

          121
          
                successful_authentication(user)
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def open_id_authenticate(openid_url)
        
      
        

          
          
              authenticate_with_open_id(openid_url, :required => [:nickname, :fullname, :email], :return_to => signin_url, :method => :post) do |result, identity_url, registration|
        
      
        

          
          
                if result.successful?
        
      
        

          
          
                  user = User.find_or_initialize_by_identity_url(identity_url)
        
      
        

          
          
                  if user.new_record?
        
      
        

          
          
                    # Self-registration off
        
      
        

          
          
                    redirect_to(home_url) && return unless Setting.self_registration?
        
      
        

          
          
          
        
      
        

          
          
                    # Create on the fly
        
      
        

          
          
                    user.login = registration['nickname'] unless registration['nickname'].nil?
        
      
        

          
          
                    user.mail = registration['email'] unless registration['email'].nil?
        
      
        

          
          
                    user.firstname, user.lastname = registration['fullname'].split(' ') unless registration['fullname'].nil?
        
      
        

          
          
                    user.random_password
        
      
        

          
          
                    user.register
        
      
        

          
          
          
        
      
        

          
          
                    case Setting.self_registration
        
      
        

          
          
                    when '1'
        
      
        

          
          
                      register_by_email_activation(user) do
        
      
        

          
          
                        onthefly_creation_failed(user)
        
      
        

          
          
                      end
        
      
        

          
          
                    when '3'
        
      
        

          
          
                      register_automatically(user) do
        
      
        

          
          
                        onthefly_creation_failed(user)
        
      
        

          
          
                      end
        
      
        

          
          
                    else
        
      
        

          
          
                      register_manually_by_administrator(user) do
        
      
        

          
          
                        onthefly_creation_failed(user)
        
      
        

          
          
                      end
        
      
        

          
          
                    end
        
      
        

          
          
                  else
        
      
        

          
          
                    # Existing record
        
      
        

          
          
                    if user.active?
        
      
        

          
          
                      successful_authentication(user)
        
      
        

          
          
                    else
        
      
        

          
          
                      account_pending
        
      
        

          
          
                    end
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def successful_authentication(user)
        
      
        

          121
          
              logger.info "Successful authentication for '#{user.login}' from #{request.remote_ip} at #{Time.now.utc}"
        
      
        

          
          
              # Valid user
        
      
        

          121
          
              self.logged_user = user
        
      
        

          
          
              # generate a key and set cookie if autologin
        
      
        

          121
          
              if params[:autologin] && Setting.autologin?
        
      
        

          
          
                set_autologin_cookie(user)
        
      
        

          
          
              end
        
      
        

          121
          
              call_hook(:controller_account_success_authentication_after, {:user => user })
        
      
        

          121
          
              redirect_back_or_default :controller => 'my', :action => 'page'
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def set_autologin_cookie(user)
        
      
        

          
          
              token = Token.create(:user => user, :action => 'autologin')
        
      
        

          
          
              cookie_name = Redmine::Configuration['autologin_cookie_name'] || 'autologin'
        
      
        

          
          
              cookie_options = {
        
      
        

          
          
                :value => token.value,
        
      
        

          
          
                :expires => 1.year.from_now,
        
      
        

          
          
                :path => (Redmine::Configuration['autologin_cookie_path'] || '/'),
        
      
        

          
          
                :secure => (Redmine::Configuration['autologin_cookie_secure'] ? true : false),
        
      
        

          
          
                :httponly => true
        
      
        

          
          
              }
        
      
        

          
          
              cookies[cookie_name] = cookie_options
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Onthefly creation failed, display the registration form to fill/fix attributes
        
      
        

          1
          
            def onthefly_creation_failed(user, auth_source_options = { })
        
      
        

          
          
              @user = user
        
      
        

          
          
              session[:auth_source_registration] = auth_source_options unless auth_source_options.empty?
        
      
        

          
          
              render :action => 'register'
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def invalid_credentials
        
      
        

          
          
              logger.warn "Failed login for '#{params[:username]}' from #{request.remote_ip} at #{Time.now.utc}"
        
      
        

          
          
              flash.now[:error] = l(:notice_account_invalid_creditentials)
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Register a user for email activation.
        
      
        

          
          
            #
        
      
        

          
          
            # Pass a block for behavior when a user fails to save
        
      
        

          1
          
            def register_by_email_activation(user, &block)
        
      
        

          
          
              token = Token.new(:user => user, :action => "register")
        
      
        

          
          
              if user.save and token.save
        
      
        

          
          
                Mailer.register(token).deliver
        
      
        

          
          
                flash[:notice] = l(:notice_account_register_done)
        
      
        

          
          
                redirect_to signin_path
        
      
        

          
          
              else
        
      
        

          
          
                yield if block_given?
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Automatically register a user
        
      
        

          
          
            #
        
      
        

          
          
            # Pass a block for behavior when a user fails to save
        
      
        

          1
          
            def register_automatically(user, &block)
        
      
        

          
          
              # Automatic activation
        
      
        

          
          
              user.activate
        
      
        

          
          
              user.last_login_on = Time.now
        
      
        

          
          
              if user.save
        
      
        

          
          
                self.logged_user = user
        
      
        

          
          
                flash[:notice] = l(:notice_account_activated)
        
      
        

          
          
                redirect_to :controller => 'my', :action => 'account'
        
      
        

          
          
              else
        
      
        

          
          
                yield if block_given?
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Manual activation by the administrator
        
      
        

          
          
            #
        
      
        

          
          
            # Pass a block for behavior when a user fails to save
        
      
        

          1
          
            def register_manually_by_administrator(user, &block)
        
      
        

          
          
              if user.save
        
      
        

          
          
                # Sends an email to the administrators
        
      
        

          
          
                Mailer.account_activation_request(user).deliver
        
      
        

          
          
                account_pending
        
      
        

          
          
              else
        
      
        

          
          
                yield if block_given?
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def account_pending
        
      
        

          
          
              flash[:notice] = l(:notice_account_pending)
        
      
        

          
          
              redirect_to signin_path
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          
          
          # Redmine - project management software
        
      
        

          
          
          # Copyright (C) 2006-2012  Jean-Philippe Lang
        
      
        

          
          
          #
        
      
        

          
          
          # This program is free software; you can redistribute it and/or
        
      
        

          
          
          # modify it under the terms of the GNU General Public License
        
      
        

          
          
          # as published by the Free Software Foundation; either version 2
        
      
        

          
          
          # of the License, or (at your option) any later version.
        
      
        

          
          
          #
        
      
        

          
          
          # This program is distributed in the hope that it will be useful,
        
      
        

          
          
          # but WITHOUT ANY WARRANTY; without even the implied warranty of
        
      
        

          
          
          # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
        
      
        

          
          
          # GNU General Public License for more details.
        
      
        

          
          
          #
        
      
        

          
          
          # You should have received a copy of the GNU General Public License
        
      
        

          
          
          # along with this program; if not, write to the Free Software
        
      
        

          
          
          # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
        
      
        

          
          
          
        
      
        

          1
          
          class ActivitiesController < ApplicationController
        
      
        

          1
          
            menu_item :activity
        
      
        

          1
          
            before_filter :find_optional_project
        
      
        

          1
          
            accept_rss_auth :index
        
      
        

          
          
          
        
      
        

          1
          
            def index
        
      
        

          
          
              @days = Setting.activity_days_default.to_i
        
      
        

          
          
          
        
      
        

          
          
              if params[:from]
        
      
        

          
          
                begin; @date_to = params[:from].to_date + 1; rescue; end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              @date_to ||= Date.today + 1
        
      
        

          
          
              @date_from = @date_to - @days
        
      
        

          
          
              @with_subprojects = params[:with_subprojects].nil? ? Setting.display_subprojects_issues? : (params[:with_subprojects] == '1')
        
      
        

          
          
              @author = (params[:user_id].blank? ? nil : User.active.find(params[:user_id]))
        
      
        

          
          
          
        
      
        

          
          
              @activity = Redmine::Activity::Fetcher.new(User.current, :project => @project,
        
      
        

          
          
                                                                       :with_subprojects => @with_subprojects,
        
      
        

          
          
                                                                       :author => @author)
        
      
        

          
          
              @activity.scope_select {|t| !params["show_#{t}"].nil?}
        
      
        

          
          
              @activity.scope = (@author.nil? ? :default : :all) if @activity.scope.empty?
        
      
        

          
          
          
        
      
        

          
          
              events = @activity.events(@date_from, @date_to)
        
      
        

          
          
          
        
      
        

          
          
              if events.empty? || stale?(:etag => [@activity.scope, @date_to, @date_from, @with_subprojects, @author, events.first, events.size, User.current, current_language])
        
      
        

          
          
                respond_to do |format|
        
      
        

          
          
                  format.html {
        
      
        

          
          
                    @events_by_day = events.group_by {|event| User.current.time_to_date(event.event_datetime)}
        
      
        

          
          
                    render :layout => false if request.xhr?
        
      
        

          
          
                  }
        
      
        

          
          
                  format.atom {
        
      
        

          
          
                    title = l(:label_activity)
        
      
        

          
          
                    if @author
        
      
        

          
          
                      title = @author.name
        
      
        

          
          
                    elsif @activity.scope.size == 1
        
      
        

          
          
                      title = l("label_#{@activity.scope.first.singularize}_plural")
        
      
        

          
          
                    end
        
      
        

          
          
                    render_feed(events, :title => "#{@project || Setting.app_title}: #{title}")
        
      
        

          
          
                  }
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
            rescue ActiveRecord::RecordNotFound
        
      
        

          
          
              render_404
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            private
        
      
        

          
          
          
        
      
        

          
          
            # TODO: refactor, duplicated in projects_controller
        
      
        

          1
          
            def find_optional_project
        
      
        

          
          
              return true unless params[:id]
        
      
        

          
          
              @project = Project.find(params[:id])
        
      
        

          
          
              authorize
        
      
        

          
          
            rescue ActiveRecord::RecordNotFound
        
      
        

          
          
              render_404
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          
          
          # Redmine - project management software
        
      
        

          
          
          # Copyright (C) 2006-2012  Jean-Philippe Lang
        
      
        

          
          
          #
        
      
        

          
          
          # This program is free software; you can redistribute it and/or
        
      
        

          
          
          # modify it under the terms of the GNU General Public License
        
      
        

          
          
          # as published by the Free Software Foundation; either version 2
        
      
        

          
          
          # of the License, or (at your option) any later version.
        
      
        

          
          
          #
        
      
        

          
          
          # This program is distributed in the hope that it will be useful,
        
      
        

          
          
          # but WITHOUT ANY WARRANTY; without even the implied warranty of
        
      
        

          
          
          # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
        
      
        

          
          
          # GNU General Public License for more details.
        
      
        

          
          
          #
        
      
        

          
          
          # You should have received a copy of the GNU General Public License
        
      
        

          
          
          # along with this program; if not, write to the Free Software
        
      
        

          
          
          # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
        
      
        

          
          
          
        
      
        

          1
          
          class AdminController < ApplicationController
        
      
        

          1
          
            layout 'admin'
        
      
        

          1
          
            menu_item :projects, :only => :projects
        
      
        

          1
          
            menu_item :plugins, :only => :plugins
        
      
        

          1
          
            menu_item :info, :only => :info
        
      
        

          
          
          
        
      
        

          1
          
            before_filter :require_admin
        
      
        

          1
          
            helper :sort
        
      
        

          1
          
            include SortHelper	
        
      
        

          
          
          
        
      
        

          1
          
            def index
        
      
        

          1
          
              @no_configuration_data = Redmine::DefaultData::Loader::no_data?
        
      
        

          
          
            end
        
      
        

          
          
          	
        
      
        

          1
          
            def projects
        
      
        

          
          
              @status = params[:status] || 1
        
      
        

          
          
          
        
      
        

          
          
              scope = Project.status(@status)
        
      
        

          
          
              scope = scope.like(params[:name]) if params[:name].present?
        
      
        

          
          
          
        
      
        

          
          
              @projects = scope.all(:order => 'lft')
        
      
        

          
          
          
        
      
        

          
          
              render :action => "projects", :layout => false if request.xhr?
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def plugins
        
      
        

          1
          
              @plugins = Redmine::Plugin.all
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Loads the default configuration
        
      
        

          
          
            # (roles, trackers, statuses, workflow, enumerations)
        
      
        

          1
          
            def default_configuration
        
      
        

          
          
              if request.post?
        
      
        

          
          
                begin
        
      
        

          
          
                  Redmine::DefaultData::Loader::load(params[:lang])
        
      
        

          
          
                  flash[:notice] = l(:notice_default_data_loaded)
        
      
        

          
          
                rescue Exception => e
        
      
        

          
          
                  flash[:error] = l(:error_can_t_load_default_data, e.message)
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
              redirect_to :action => 'index'
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def test_email
        
      
        

          
          
              raise_delivery_errors = ActionMailer::Base.raise_delivery_errors
        
      
        

          
          
              # Force ActionMailer to raise delivery errors so we can catch it
        
      
        

          
          
              ActionMailer::Base.raise_delivery_errors = true
        
      
        

          
          
              begin
        
      
        

          
          
                @test = Mailer.test_email(User.current).deliver
        
      
        

          
          
                flash[:notice] = l(:notice_email_sent, User.current.mail)
        
      
        

          
          
              rescue Exception => e
        
      
        

          
          
                flash[:error] = l(:notice_email_error, e.message)
        
      
        

          
          
              end
        
      
        

          
          
              ActionMailer::Base.raise_delivery_errors = raise_delivery_errors
        
      
        

          
          
              redirect_to :controller => 'settings', :action => 'edit', :tab => 'notifications'
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def info
        
      
        

          
          
              @db_adapter_name = ActiveRecord::Base.connection.adapter_name
        
      
        

          
          
              @checklist = [
        
      
        

          
          
                [:text_default_administrator_account_changed, User.default_admin_account_changed?],
        
      
        

          
          
                [:text_file_repository_writable, File.writable?(Attachment.storage_path)],
        
      
        

          
          
                [:text_plugin_assets_writable,   File.writable?(Redmine::Plugin.public_directory)],
        
      
        

          
          
                [:text_rmagick_available,        Object.const_defined?(:Magick)]
        
      
        

          
          
              ]
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          
          
          # Redmine - project management software
        
      
        

          
          
          # Copyright (C) 2006-2012  Jean-Philippe Lang
        
      
        

          
          
          #
        
      
        

          
          
          # This program is free software; you can redistribute it and/or
        
      
        

          
          
          # modify it under the terms of the GNU General Public License
        
      
        

          
          
          # as published by the Free Software Foundation; either version 2
        
      
        

          
          
          # of the License, or (at your option) any later version.
        
      
        

          
          
          #
        
      
        

          
          
          # This program is distributed in the hope that it will be useful,
        
      
        

          
          
          # but WITHOUT ANY WARRANTY; without even the implied warranty of
        
      
        

          
          
          # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
        
      
        

          
          
          # GNU General Public License for more details.
        
      
        

          
          
          #
        
      
        

          
          
          # You should have received a copy of the GNU General Public License
        
      
        

          
          
          # along with this program; if not, write to the Free Software
        
      
        

          
          
          # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
        
      
        

          
          
          
        
      
        

          1
          
          require 'uri'
        
      
        

          1
          
          require 'cgi'
        
      
        

          
          
          
        
      
        

          1
          
          class Unauthorized < Exception; end
        
      
        

          
          
          
        
      
        

          1
          
          class ApplicationController < ActionController::Base
        
      
        

          1
          
            include Redmine::I18n
        
      
        

          
          
          
        
      
        

          1
          
            class_attribute :accept_api_auth_actions
        
      
        

          1
          
            class_attribute :accept_rss_auth_actions
        
      
        

          1
          
            class_attribute :model_object
        
      
        

          
          
          
        
      
        

          1
          
            layout 'base'
        
      
        

          
          
          
        
      
        

          1
          
            protect_from_forgery
        
      
        

          1
          
            def handle_unverified_request
        
      
        

          
          
              super
        
      
        

          
          
              cookies.delete(:autologin)
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            before_filter :session_expiration, :user_setup, :check_if_login_required, :set_localization
        
      
        

          
          
          
        
      
        

          1
          
            rescue_from ActionController::InvalidAuthenticityToken, :with => :invalid_authenticity_token
        
      
        

          1
          
            rescue_from ::Unauthorized, :with => :deny_access
        
      
        

          1
          
            rescue_from ::ActionView::MissingTemplate, :with => :missing_template
        
      
        

          
          
          
        
      
        

          1
          
            include Redmine::Search::Controller
        
      
        

          1
          
            include Redmine::MenuManager::MenuController
        
      
        

          1
          
            helper Redmine::MenuManager::MenuHelper
        
      
        

          
          
          
        
      
        

          1
          
            def session_expiration
        
      
        

          841
          
              if session[:user_id]
        
      
        

          582
          
                if session_expired? && !try_to_autologin
        
      
        

          
          
                  reset_session
        
      
        

          
          
                  flash[:error] = l(:error_session_expired)
        
      
        

          
          
                  redirect_to signin_url
        
      
        

          
          
                else
        
      
        

          582
          
                  session[:atime] = Time.now.utc.to_i
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def session_expired?
        
      
        

          582
          
              if Setting.session_lifetime?
        
      
        

          
          
                unless session[:ctime] && (Time.now.utc.to_i - session[:ctime].to_i <= Setting.session_lifetime.to_i * 60)
        
      
        

          
          
                  return true
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          582
          
              if Setting.session_timeout?
        
      
        

          
          
                unless session[:atime] && (Time.now.utc.to_i - session[:atime].to_i <= Setting.session_timeout.to_i * 60)
        
      
        

          
          
                  return true
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          582
          
              false
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def start_user_session(user)
        
      
        

          121
          
              session[:user_id] = user.id
        
      
        

          121
          
              session[:ctime] = Time.now.utc.to_i
        
      
        

          121
          
              session[:atime] = Time.now.utc.to_i
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def user_setup
        
      
        

          
          
              # Check the settings cache for each request
        
      
        

          841
          
              Setting.check_cache
        
      
        

          
          
              # Find the current user
        
      
        

          841
          
              User.current = find_current_user
        
      
        

          841
          
              logger.info("  Current user: " + (User.current.logged? ? "#{User.current.login} (id=#{User.current.id})" : "anonymous")) if logger
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Returns the current user or nil if no user is logged in
        
      
        

          
          
            # and starts a session if needed
        
      
        

          1
          
            def find_current_user
        
      
        

          841
          
              user = nil
        
      
        

          841
          
              unless api_request?
        
      
        

          839
          
                if session[:user_id]
        
      
        

          
          
                  # existing session
        
      
        

          582
          
                  user = (User.active.find(session[:user_id]) rescue nil)
        
      
        

          
          
                elsif autologin_user = try_to_autologin
        
      
        

          
          
                  user = autologin_user
        
      
        

          
          
                elsif params[:format] == 'atom' && params[:key] && request.get? && accept_rss_auth?
        
      
        

          
          
                  # RSS key authentication does not start a session
        
      
        

          
          
                  user = User.find_by_rss_key(params[:key])
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          841
          
              if user.nil? && Setting.rest_api_enabled? && accept_api_auth?
        
      
        

          2
          
                if (key = api_key_from_request)
        
      
        

          
          
                  # Use API key
        
      
        

          2
          
                  user = User.find_by_api_key(key)
        
      
        

          
          
                else
        
      
        

          
          
                  # HTTP Basic, either username/password or API key/random
        
      
        

          
          
                  authenticate_with_http_basic do |username, password|
        
      
        

          
          
                    user = User.try_to_login(username, password) || User.find_by_api_key(username)
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
                # Switch user if requested by an admin user
        
      
        

          2
          
                if user && user.admin? && (username = api_switch_user_from_request)
        
      
        

          
          
                  su = User.find_by_login(username)
        
      
        

          
          
                  if su && su.active?
        
      
        

          
          
                    logger.info("  User switched by: #{user.login} (id=#{user.id})") if logger
        
      
        

          
          
                    user = su
        
      
        

          
          
                  else
        
      
        

          
          
                    render_error :message => 'Invalid X-Redmine-Switch-User header', :status => 412
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          841
          
              user
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def try_to_autologin
        
      
        

          257
          
              if cookies[:autologin] && Setting.autologin?
        
      
        

          
          
                # auto-login feature starts a new session
        
      
        

          
          
                user = User.try_to_autologin(cookies[:autologin])
        
      
        

          
          
                if user
        
      
        

          
          
                  reset_session
        
      
        

          
          
                  start_user_session(user)
        
      
        

          
          
                end
        
      
        

          
          
                user
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Sets the logged in user
        
      
        

          1
          
            def logged_user=(user)
        
      
        

          142
          
              reset_session
        
      
        

          142
          
              if user && user.is_a?(User)
        
      
        

          121
          
                User.current = user
        
      
        

          121
          
                start_user_session(user)
        
      
        

          
          
              else
        
      
        

          21
          
                User.current = User.anonymous
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Logs out current user
        
      
        

          1
          
            def logout_user
        
      
        

          125
          
              if User.current.logged?
        
      
        

          21
          
                cookies.delete :autologin
        
      
        

          21
          
                Token.delete_all(["user_id = ? AND action = ?", User.current.id, 'autologin'])
        
      
        

          21
          
                self.logged_user = nil
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # check if login is globally required to access the application
        
      
        

          1
          
            def check_if_login_required
        
      
        

          
          
              # no check needed if user is already logged in
        
      
        

          595
          
              return true if User.current.logged?
        
      
        

          33
          
              require_login if Setting.login_required?
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def set_localization
        
      
        

          841
          
              lang = nil
        
      
        

          841
          
              if User.current.logged?
        
      
        

          583
          
                lang = find_language(User.current.language)
        
      
        

          
          
              end
        
      
        

          841
          
              if lang.nil? && request.env['HTTP_ACCEPT_LANGUAGE']
        
      
        

          47
          
                accept_lang = parse_qvalues(request.env['HTTP_ACCEPT_LANGUAGE']).first
        
      
        

          47
          
                if !accept_lang.blank?
        
      
        

          47
          
                  accept_lang = accept_lang.downcase
        
      
        

          47
          
                  lang = find_language(accept_lang) || find_language(accept_lang.split('-').first)
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          841
          
              lang ||= Setting.default_language
        
      
        

          841
          
              set_language_if_valid(lang)
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def require_login
        
      
        

          130
          
              if !User.current.logged?
        
      
        

          
          
                # Extract only the basic url parameters on non-GET requests
        
      
        

          6
          
                if request.get?
        
      
        

          1
          
                  url = url_for(params)
        
      
        

          
          
                else
        
      
        

          5
          
                  url = url_for(:controller => params[:controller], :action => params[:action], :id => params[:id], :project_id => params[:project_id])
        
      
        

          
          
                end
        
      
        

          6
          
                respond_to do |format|
        
      
        

          9
          
                  format.html { redirect_to :controller => "account", :action => "login", :back_url => url }
        
      
        

          6
          
                  format.atom { redirect_to :controller => "account", :action => "login", :back_url => url }
        
      
        

          7
          
                  format.xml  { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
        
      
        

          8
          
                  format.js   { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
        
      
        

          6
          
                  format.json { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
        
      
        

          
          
                end
        
      
        

          6
          
                return false
        
      
        

          
          
              end
        
      
        

          124
          
              true
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def require_admin
        
      
        

          3
          
              return unless require_login
        
      
        

          3
          
              if !User.current.admin?
        
      
        

          
          
                render_403
        
      
        

          
          
                return false
        
      
        

          
          
              end
        
      
        

          3
          
              true
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def deny_access
        
      
        

          8
          
              User.current.logged? ? render_403 : require_login
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Authorize the user for the requested action
        
      
        

          1
          
            def authorize(ctrl = params[:controller], action = params[:action], global = false)
        
      
        

          373
          
              allowed = User.current.allowed_to?({:controller => ctrl, :action => action}, @project || @projects, :global => global)
        
      
        

          373
          
              if allowed
        
      
        

          365
          
                true
        
      
        

          
          
              else
        
      
        

          8
          
                if @project && @project.archived?
        
      
        

          
          
                  render_403 :message => :notice_not_authorized_archived_project
        
      
        

          
          
                else
        
      
        

          8
          
                  deny_access
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Authorize the user for the requested action outside a project
        
      
        

          1
          
            def authorize_global(ctrl = params[:controller], action = params[:action], global = true)
        
      
        

          7
          
              authorize(ctrl, action, global)
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Find project of id params[:id]
        
      
        

          1
          
            def find_project
        
      
        

          69
          
              @project = Project.find(params[:id])
        
      
        

          
          
            rescue ActiveRecord::RecordNotFound
        
      
        

          
          
              render_404
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Find project of id params[:project_id]
        
      
        

          1
          
            def find_project_by_project_id
        
      
        

          
          
              @project = Project.find(params[:project_id])
        
      
        

          
          
            rescue ActiveRecord::RecordNotFound
        
      
        

          
          
              render_404
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Find a project based on params[:project_id]
        
      
        

          
          
            # TODO: some subclasses override this, see about merging their logic
        
      
        

          1
          
            def find_optional_project
        
      
        

          16
          
              @project = Project.find(params[:project_id]) unless params[:project_id].blank?
        
      
        

          16
          
              allowed = User.current.allowed_to?({:controller => params[:controller], :action => params[:action]}, @project, :global => true)
        
      
        

          16
          
              allowed ? true : deny_access
        
      
        

          
          
            rescue ActiveRecord::RecordNotFound
        
      
        

          
          
              render_404
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Finds and sets @project based on @object.project
        
      
        

          1
          
            def find_project_from_association
        
      
        

          1
          
              render_404 unless @object.present?
        
      
        

          
          
          
        
      
        

          1
          
              @project = @object.project
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def find_model_object
        
      
        

          1
          
              model = self.class.model_object
        
      
        

          1
          
              if model
        
      
        

          1
          
                @object = model.find(params[:id])
        
      
        

          1
          
                self.instance_variable_set('@' + controller_name.singularize, @object) if @object
        
      
        

          
          
              end
        
      
        

          
          
            rescue ActiveRecord::RecordNotFound
        
      
        

          
          
              render_404
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def self.model_object(model)
        
      
        

          6
          
              self.model_object = model
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Find the issue whose id is the :id parameter
        
      
        

          
          
            # Raises a Unauthorized exception if the issue is not visible
        
      
        

          1
          
            def find_issue
        
      
        

          
          
              # Issue.visible.find(...) can not be used to redirect user to the login form
        
      
        

          
          
              # if the issue actually exists but requires authentication
        
      
        

          3
          
              @issue = Issue.find(params[:id])
        
      
        

          3
          
              raise Unauthorized unless @issue.visible?
        
      
        

          3
          
              @project = @issue.project
        
      
        

          
          
            rescue ActiveRecord::RecordNotFound
        
      
        

          
          
              render_404
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Find issues with a single :id param or :ids array param
        
      
        

          
          
            # Raises a Unauthorized exception if one of the issues is not visible
        
      
        

          1
          
            def find_issues
        
      
        

          
          
              @issues = Issue.find_all_by_id(params[:id] || params[:ids])
        
      
        

          
          
              raise ActiveRecord::RecordNotFound if @issues.empty?
        
      
        

          
          
              raise Unauthorized unless @issues.all?(&:visible?)
        
      
        

          
          
              @projects = @issues.collect(&:project).compact.uniq
        
      
        

          
          
              @project = @projects.first if @projects.size == 1
        
      
        

          
          
            rescue ActiveRecord::RecordNotFound
        
      
        

          
          
              render_404
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # make sure that the user is a member of the project (or admin) if project is private
        
      
        

          
          
            # used as a before_filter for actions that do not require any particular permission on the project
        
      
        

          1
          
            def check_project_privacy
        
      
        

          
          
              if @project && !@project.archived?
        
      
        

          
          
                if @project.visible?
        
      
        

          
          
                  true
        
      
        

          
          
                else
        
      
        

          
          
                  deny_access
        
      
        

          
          
                end
        
      
        

          
          
              else
        
      
        

          
          
                @project = nil
        
      
        

          
          
                render_404
        
      
        

          
          
                false
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def back_url
        
      
        

          
          
              url = params[:back_url]
        
      
        

          
          
              if url.nil? && referer = request.env['HTTP_REFERER']
        
      
        

          
          
                url = CGI.unescape(referer.to_s)
        
      
        

          
          
              end
        
      
        

          
          
              url
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def redirect_back_or_default(default)
        
      
        

          123
          
              back_url = params[:back_url].to_s
        
      
        

          123
          
              if back_url.present?
        
      
        

          2
          
                begin
        
      
        

          2
          
                  uri = URI.parse(back_url)
        
      
        

          
          
                  # do not redirect user to another host or to the login or register page
        
      
        

          2
          
                  if (uri.relative? || (uri.host == request.host)) && !uri.path.match(%r{/(login|account/register)})
        
      
        

          2
          
                    redirect_to(back_url)
        
      
        

          2
          
                    return
        
      
        

          
          
                  end
        
      
        

          
          
                rescue URI::InvalidURIError
        
      
        

          
          
                  logger.warn("Could not redirect to invalid URL #{back_url}")
        
      
        

          
          
                  # redirect to default
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          121
          
              redirect_to default
        
      
        

          121
          
              false
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Redirects to the request referer if present, redirects to args or call block otherwise.
        
      
        

          1
          
            def redirect_to_referer_or(*args, &block)
        
      
        

          
          
              redirect_to :back
        
      
        

          
          
            rescue ::ActionController::RedirectBackError
        
      
        

          
          
              if args.any?
        
      
        

          
          
                redirect_to *args
        
      
        

          
          
              elsif block_given?
        
      
        

          
          
                block.call
        
      
        

          
          
              else
        
      
        

          
          
                raise "#redirect_to_referer_or takes arguments or a block"
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def render_403(options={})
        
      
        

          2
          
              @project = nil
        
      
        

          2
          
              render_error({:message => :notice_not_authorized, :status => 403}.merge(options))
        
      
        

          2
          
              return false
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def render_404(options={})
        
      
        

          
          
              render_error({:message => :notice_file_not_found, :status => 404}.merge(options))
        
      
        

          
          
              return false
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Renders an error response
        
      
        

          1
          
            def render_error(arg)
        
      
        

          2
          
              arg = {:message => arg} unless arg.is_a?(Hash)
        
      
        

          
          
          
        
      
        

          2
          
              @message = arg[:message]
        
      
        

          2
          
              @message = l(@message) if @message.is_a?(Symbol)
        
      
        

          2
          
              @status = arg[:status] || 500
        
      
        

          
          
          
        
      
        

          2
          
              respond_to do |format|
        
      
        

          2
          
                format.html {
        
      
        

          2
          
                  render :template => 'common/error', :layout => use_layout, :status => @status
        
      
        

          
          
                }
        
      
        

          2
          
                format.any { head @status }
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Handler for ActionView::MissingTemplate exception
        
      
        

          1
          
            def missing_template
        
      
        

          
          
              logger.warn "Missing template, responding with 404"
        
      
        

          
          
              @project = nil
        
      
        

          
          
              render_404
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Filter for actions that provide an API response
        
      
        

          
          
            # but have no HTML representation for non admin users
        
      
        

          1
          
            def require_admin_or_api_request
        
      
        

          1
          
              return true if api_request?
        
      
        

          
          
              if User.current.admin?
        
      
        

          
          
                true
        
      
        

          
          
              elsif User.current.logged?
        
      
        

          
          
                render_error(:status => 406)
        
      
        

          
          
              else
        
      
        

          
          
                deny_access
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Picks which layout to use based on the request
        
      
        

          
          
            #
        
      
        

          
          
            # @return [boolean, string] name of the layout to use or false for no layout
        
      
        

          1
          
            def use_layout
        
      
        

          2
          
              request.xhr? ? false : 'base'
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def invalid_authenticity_token
        
      
        

          
          
              if api_request?
        
      
        

          
          
                logger.error "Form authenticity token is missing or is invalid. API calls must include a proper Content-type header (text/xml or text/json)."
        
      
        

          
          
              end
        
      
        

          
          
              render_error "Invalid form authenticity token."
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def render_feed(items, options={})
        
      
        

          
          
              @items = items || []
        
      
        

          
          
              @items.sort! {|x,y| y.event_datetime <=> x.event_datetime }
        
      
        

          
          
              @items = @items.slice(0, Setting.feeds_limit.to_i)
        
      
        

          
          
              @title = options[:title] || Setting.app_title
        
      
        

          
          
              render :template => "common/feed", :formats => [:atom], :layout => false,
        
      
        

          
          
                     :content_type => 'application/atom+xml'
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def self.accept_rss_auth(*actions)
        
      
        

          8
          
              if actions.any?
        
      
        

          8
          
                self.accept_rss_auth_actions = actions
        
      
        

          
          
              else
        
      
        

          
          
                self.accept_rss_auth_actions || []
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def accept_rss_auth?(action=action_name)
        
      
        

          
          
              self.class.accept_rss_auth.include?(action.to_sym)
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def self.accept_api_auth(*actions)
        
      
        

          22
          
              if actions.any?
        
      
        

          18
          
                self.accept_api_auth_actions = actions
        
      
        

          
          
              else
        
      
        

          4
          
                self.accept_api_auth_actions || []
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def accept_api_auth?(action=action_name)
        
      
        

          4
          
              self.class.accept_api_auth.include?(action.to_sym)
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Returns the number of objects that should be displayed
        
      
        

          
          
            # on the paginated list
        
      
        

          1
          
            def per_page_option
        
      
        

          20
          
              per_page = nil
        
      
        

          20
          
              if params[:per_page] && Setting.per_page_options_array.include?(params[:per_page].to_s.to_i)
        
      
        

          
          
                per_page = params[:per_page].to_s.to_i
        
      
        

          
          
                session[:per_page] = per_page
        
      
        

          
          
              elsif session[:per_page]
        
      
        

          
          
                per_page = session[:per_page]
        
      
        

          
          
              else
        
      
        

          20
          
                per_page = Setting.per_page_options_array.first || 25
        
      
        

          
          
              end
        
      
        

          20
          
              per_page
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Returns offset and limit used to retrieve objects
        
      
        

          
          
            # for an API response based on offset, limit and page parameters
        
      
        

          1
          
            def api_offset_and_limit(options=params)
        
      
        

          
          
              if options[:offset].present?
        
      
        

          
          
                offset = options[:offset].to_i
        
      
        

          
          
                if offset < 0
        
      
        

          
          
                  offset = 0
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
              limit = options[:limit].to_i
        
      
        

          
          
              if limit < 1
        
      
        

          
          
                limit = 25
        
      
        

          
          
              elsif limit > 100
        
      
        

          
          
                limit = 100
        
      
        

          
          
              end
        
      
        

          
          
              if offset.nil? && options[:page].present?
        
      
        

          
          
                offset = (options[:page].to_i - 1) * limit
        
      
        

          
          
                offset = 0 if offset < 0
        
      
        

          
          
              end
        
      
        

          
          
              offset ||= 0
        
      
        

          
          
          
        
      
        

          
          
              [offset, limit]
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # qvalues http header parser
        
      
        

          
          
            # code taken from webrick
        
      
        

          1
          
            def parse_qvalues(value)
        
      
        

          47
          
              tmp = []
        
      
        

          47
          
              if value
        
      
        

          47
          
                parts = value.split(/,\s*/)
        
      
        

          47
          
                parts.each {|part|
        
      
        

          94
          
                  if m = %r{^([^\s,]+?)(?:;\s*q=(\d+(?:\.\d+)?))?$}.match(part)
        
      
        

          94
          
                    val = m[1]
        
      
        

          94
          
                    q = (m[2] or 1).to_f
        
      
        

          94
          
                    tmp.push([val, q])
        
      
        

          
          
                  end
        
      
        

          
          
                }
        
      
        

          141
          
                tmp = tmp.sort_by{|val, q| -q}
        
      
        

          141
          
                tmp.collect!{|val, q| val}
        
      
        

          
          
              end
        
      
        

          47
          
              return tmp
        
      
        

          
          
            rescue
        
      
        

          
          
              nil
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Returns a string that can be used as filename value in Content-Disposition header
        
      
        

          1
          
            def filename_for_content_disposition(name)
        
      
        

          
          
              request.env['HTTP_USER_AGENT'] =~ %r{MSIE} ? ERB::Util.url_encode(name) : name
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def api_request?
        
      
        

          2010
          
              %w(xml json).include? params[:format]
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Returns the API key present in the request
        
      
        

          1
          
            def api_key_from_request
        
      
        

          2
          
              if params[:key].present?
        
      
        

          2
          
                params[:key].to_s
        
      
        

          
          
              elsif request.headers["X-Redmine-API-Key"].present?
        
      
        

          
          
                request.headers["X-Redmine-API-Key"].to_s
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Returns the API 'switch user' value if present
        
      
        

          1
          
            def api_switch_user_from_request
        
      
        

          
          
              request.headers["X-Redmine-Switch-User"].to_s.presence
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Renders a warning flash if obj has unsaved attachments
        
      
        

          1
          
            def render_attachment_warning_if_needed(obj)
        
      
        

          2
          
              flash[:warning] = l(:warning_attachments_not_saved, obj.unsaved_attachments.size) if obj.unsaved_attachments.present?
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Sets the `flash` notice or error based the number of issues that did not save
        
      
        

          
          
            #
        
      
        

          
          
            # @param [Array, Issue] issues all of the saved and unsaved Issues
        
      
        

          
          
            # @param [Array, Integer] unsaved_issue_ids the issue ids that were not saved
        
      
        

          1
          
            def set_flash_from_bulk_issue_save(issues, unsaved_issue_ids)
        
      
        

          
          
              if unsaved_issue_ids.empty?
        
      
        

          
          
                flash[:notice] = l(:notice_successful_update) unless issues.empty?
        
      
        

          
          
              else
        
      
        

          
          
                flash[:error] = l(:notice_failed_to_save_issues,
        
      
        

          
          
                                  :count => unsaved_issue_ids.size,
        
      
        

          
          
                                  :total => issues.size,
        
      
        

          
          
                                  :ids => '#' + unsaved_issue_ids.join(', #'))
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Rescues an invalid query statement. Just in case...
        
      
        

          1
          
            def query_statement_invalid(exception)
        
      
        

          
          
              logger.error "Query::StatementInvalid: #{exception.message}" if logger
        
      
        

          
          
              session.delete(:query)
        
      
        

          
          
              sort_clear if respond_to?(:sort_clear)
        
      
        

          
          
              render_error "An error occurred while executing the query and has been logged. Please report this error to your Redmine administrator."
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Renders a 200 response for successfull updates or deletions via the API
        
      
        

          1
          
            def render_api_ok
        
      
        

          
          
              render_api_head :ok
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Renders a head API response
        
      
        

          1
          
            def render_api_head(status)
        
      
        

          
          
              # #head would return a response body with one space
        
      
        

          
          
              render :text => '', :status => status, :layout => nil
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Renders API response on validation failure
        
      
        

          1
          
            def render_validation_errors(objects)
        
      
        

          
          
              if objects.is_a?(Array)
        
      
        

          
          
                @error_messages = objects.map {|object| object.errors.full_messages}.flatten
        
      
        

          
          
              else
        
      
        

          
          
                @error_messages = objects.errors.full_messages
        
      
        

          
          
              end
        
      
        

          
          
              render :template => 'common/error_messages.api', :status => :unprocessable_entity, :layout => nil
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Overrides #_include_layout? so that #render with no arguments
        
      
        

          
          
            # doesn't use the layout for api requests
        
      
        

          1
          
            def _include_layout?(*args)
        
      
        

          1152
          
              api_request? ? false : super
        
      
        

          
          
            end
        
      
        

          
          
          end